Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c.Referenceshttps://github.com/ccxvii/mujs/issues/136
